> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rankraft.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and privacy configuration

> What the plugin sends, what it never sends, redaction, trusted proxies and key storage.

## What is sent

For each public front-end request: timestamp, host, path, HTTP method, status code, response size, visitor IP address, user agent, referrer (scheme, host and path only) and the query string with sensitive keys removed.

Requests go to `https://ingest.rankraft.ai` about once a minute. That address is fixed and can't be changed.

## What is never sent

* Cookies, form data, page content or anything about logged-in users.
* Anything from the admin area, logged-in dashboards, REST calls, AJAX, cron or WP-CLI.
* These paths, which are always excluded and can't be re-enabled: `wp-admin/*`, `wp-login.php`, `wp-cron.php`, `wp-json/*`, `admin-ajax.php`, `xmlrpc.php`, `/checkout*`, `/cart*`, `/my-account*`.

Add your own patterns under **Privacy → Also never log these paths**.

## Query string redaction

Query parameters whose names contain any of the following are replaced with `[REDACTED]` before anything leaves your server:

`password`, `pass`, `pwd`, `token`, `auth`, `key`, `secret`, `card`, `cc`, `ssn`, `email`, `otp`, `code`, `nonce`, `session`

The list is fixed and can't be switched off. Developers can add more names with the `rankraft_aa_redact_keys` filter.

## How RankRaft AI stores it

IP addresses are used to [verify crawlers](/agent-analytics/crawler-verification) against providers' published ranges, then stored only as a salted hash that rotates daily. Raw user agents, query strings and referrers aren't stored. Human visits are counted, not logged. See the [privacy policy](https://rankraft.ai/privacy).

## Trusted proxies

The plugin needs the visitor's real IP address to verify crawlers. It decides which address to trust like this:

* **Behind Cloudflare:** if the connection comes from Cloudflare's published ranges, it uses `CF-Connecting-IP`. No setup needed.
* **Behind a local or private proxy:** it uses `True-Client-IP`, then `X-Real-IP`, then the last `X-Forwarded-For` hop.
* **Otherwise:** it uses the connecting address and ignores forwarding headers, so they can't be forged.

If your site sits behind another CDN or load balancer with public IP addresses, add them with a filter. Otherwise genuine crawlers will show as **Spoofed**:

```php theme={"system"}
add_filter( 'rankraft_aa_trusted_proxies', fn() => [ '203.0.113.0/24' ] );
```

## Site key storage

The key is encrypted with libsodium using your WordPress salts (`AUTH_KEY` and `SECURE_AUTH_KEY`). If the Sodium extension is missing, it is stored as typed and the plugin shows a notice. Defining `RANKRAFT_SITE_KEY` in `wp-config.php` keeps the key out of the database entirely.

## WordPress privacy policy

The plugin offers suggested policy text under **Settings → Privacy → Policy Guide**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.